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Why GAO Did This Study 

To help secure the nation's ports 
against a terrorist attack, federal 
regulations have required cargo 
and other maritime facilities to 
have security plans in place since 
July 2004. U.S Coast Guard (USCG) 
guidance calls for an annual 
inspection to ensure that plans are 
being followed. Federal law 
enacted in October 2006 required 
such facilities to be inspected two 
times a year — one of which is to be 
conducted unannounced. The 
USCG plans to conduct one 
announced inspection and the 
other as a less comprehensive 
unannounced "spot check." GAO 
examined the extent to which the 
USCG (1) has met inspection 
requirements and found facilities to 
be complying with their plans, (2) 
has determined the availability of 
trained personnel to meet current 
and future facility inspection 
requirements, and (3) has assessed 
the effectiveness of its facility 
inspection program and ensured 
that program compliance data 
collected and reported are reliable. 
GAO analyzed USCG compliance 
data, interviewed inspectors and 
other stakeholders in 7 of 35 USCG 
sectors of varying size, geographic 
location, and type of waterway. 



What GAO Recommends 



GAO recommends the USCG 
reassess the number of inspection 
staff needed, compare varying 
approaches taken by local units in 
conducting inspections, and 
improve its facility compliance 
data. The Department of Homeland 
Security agreed with GAO's 
recommendations. 



To view the full product, including the scope 
and methodology, click on GAO-08-12. 
For more information, contact Stephen 
Caldwell at (202) 512-8777, 
caldwells @ gao.gov. 



What GAO Found 

We could not determine the extent to which the USCG has met inspection 
requirements because its compliance database does not identify all regulated 
facilities to establish how many should have been inspected. While the USCG 
estimates there are about 3,200 facilities requiring inspection, their records 
indicate 2,126 annual inspections were conducted in 2006. Headquarters 
officials said field units reported that all required facility inspections were 
conducted. However, officials also said some inspections may not have been 
recorded, or were delayed by staff being diverted for natural disasters. The 
USCG identified deficiencies in about one-third of inspections, mainly for 
problems with access controls or missing documentation. Over 80 percent of 
deficiencies identified by the USCG were resolved by facility operators 
without the USCG applying formal enforcement actions. 

Although USCG officials believe they have enough trained inspectors to 
conduct current and future inspections, two additional factors could affect the 
USCG's estimates of the number of inspectors needed. First, facility 
inspectors balance security inspections with other competing duties, such as 
safety or pollution checks, and giving priority to security inspections could 
affect these other duties, inspectors said. Second, new guidance for spot 
checks calls for these checks to be more detailed — and perhaps more time- 
consuming — than some USCG units conducted in the past. For example, the 
guidance now requires an on-site visit, whereas some units had allowed the 
check to be a drive-by observation. The effect of the new guidance on 
resource requirements in these units is unknown. 

The USCG has not assessed the effectiveness of its facility inspection 
program. Headquarters guidance gives considerable discretion to local USCG 
units in deciding how to conduct facility inspections — for example, deciding 
whether a fine is warranted. The USCG has little or no information, however, 
on which approaches work better than others and is therefore limited in being 
able to make informed decisions in guiding the program. Flaws in USCG's 
database, including missing, duplicate, and inconsistent information, 
complicate the USCG's ability to conduct such analyses or provide other 
information for making management decisions. 

Types of Deficiencies Noted by the USCG in Facility Inspections during 2006 

Security measures for access control 

Facility recordkeeping requirements 



Security measures for restricted areas 
Drill and exercise requirements 

Facility Security Plan amendment and audit requirements 

All other deficiencies 
Source: GAO analysis of Coast Guard compliance data. 
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^ G A O 

— Accountability * Integrity * Reliability 

United States Government Accountability Office 
Washington, DC 20548 



February 14, 2008 

The Honorable Senator Daniel Inouye 
Chairman 

The Honorable Ted Stevens 
Vice Chairman 

Committee on Commerce, Science and Transportation 
United States Senate 

The security of more than 3,200 terminals, chemical plants, factories, and 
power plants plays an important role in the protection of our nation's 
ports. Ports and waterways represent attractive targets for terrorist attack, 
given their importance to the economy, abundance of specific targets, 
proximity to large populations, and accessibility by water and land. To 
reduce the opportunity for terrorists to exploit security vulnerabilities, as 
well as to help minimize the effects of accidents or natural disasters, 
facilities are required to implement security plans to maintain physical, 
passenger, cargo, and personnel security and may utilize measures such as 
fences, security guards, and monitoring activities using cameras. 
Efficiently implementing such plans can reduce the potential for 
unauthorized entry and help prevent vulnerabilities from being exploited 
to kill people, cause environmental damage, or disrupt transportation 
systems and the economy. 

Much of the federal framework for port security is contained in the 
Maritime Transportation Security Act of 2002 (MTSA). 1 MTSA establishes 
requirements for various layers of maritime security, including requiring a 
national security plan, area security plans, and facility and vessel security 
plans. 2 The act calls for various types of facilities to develop and 
implement a security plan, and it places federal responsibility for 
approving and overseeing these plans with the Department of Homeland 
Security (DHS). DHS has placed lead responsibility for this and other 
MTSA requirements with the U.S. Coast Guard. Subsequent Coast Guard 
guidance in 2003-2004 called for conducting annual on-site inspections to 
verify a facility's compliance with its security plan. The guidance also calls 



1 Pub L. No. 107-295, 116 Stat. 2064 (2002). 

2 In this report, we refer to facilities subject to MTSA regulation collectively as "MTSA 
facilities." MTSA also required certain vessels to have a security plan. Vessel security plans 
are not discussed in this report. 
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for the Coast Guard to provide additional oversight at any time based on 
perceived risk. 

In 2004 we reviewed the implementation of these and other MTSA 
provisions. 3 We reported that facility owners and operators had made 
progress in developing their security plans but expressed concerns about 
challenges the Coast Guard faced in ensuring enough well-trained 
inspectors and equipping them with adequate guidance to conduct 
thorough, consistent reviews. We reported that the Coast Guard was in an 
initial "surge" period during which it had to cope with reviewing security 
plans submitted at the time for more than 3,000 facilities and over 9,000 
vessels. We recommended that after this initial 6-month period, the Coast 
Guard use the experience to evaluate its initial compliance strategy and 
take steps to strength the compliance process for the long term. 

Since 2004, requirements for inspecting maritime facilities have increased. 
The Security and Accountability For Every Port Act (SAFE Port Act), 
enacted in October 2006, among other things, amended MTSA to direct the 
Coast Guard to inspect facility compliance with its approved facility 
security plan periodically, but not less than two times per year, at least one 
of which shall be an inspection of the facility that is conducted without 
notice to the facility. 4 Thus, in effect, under the SAFE Port Act maritime 
facility inspection requirements, in addition to an annual inspection, the 
Coast Guard is also required to make a second unannounced inspection of 
each MTSA facility. 5 

You asked us to review the Coast Guard's progress in dealing with these 
expanded inspection requirements and developing a sound oversight 
strategy. This report addresses the extent to which the Coast Guard 



3 GAO, Maritime Security: Substantial Work Remains to Translate New Planning 
Requirements into Effective Port Security, GAO-04-838 (Washington, D.C.: June 2004). 

4 Pub. L. No. 109-347, 120 Stat. 1884, 1888 (2006). The act stipulated that this inspection 
requirement was subject to the availability of appropriations. From fiscal year 2007 DHS 
appropriations, $4.5 million has been allocated to implement the unannounced inspection 
requirement. 

° In this report we refer to two types of inspections to ensure facility compliance with their 
approved security plan. We use the terms annual compliance exam, or annual exam to 
indicate a comprehensive annual inspection of a facility. The annual exam is pre-scheduled 
with facilities (announced) unless otherwise indicated. We use the term security "spot 
check" adopted by the Coast Guard to refer to an unannounced inspection of facility 
compliance less comprehensive than the annual exam. 
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• has met its maritime facility inspection requirements and has found 
facilities to be in compliance with their security plans, 

• has determined the availability of trained personnel to meet current 
and future facility inspection requirements, and 

• has assessed the effectiveness of its MTSA facility oversight program 
and ensured that program compliance data collected and reported are 
reliable. 

To address these questions, we conducted work at Coast Guard 
headquarters and at various ports in seven of the Coast Guard's 35 
sectors. 6 Within each sector, we interviewed Coast Guard officials and 
inspectors, facility security officials at 29 selected MTSA facilities, and 
other port stakeholders. We obtained and analyzed data from 2004-2006 on 
Coast Guard's facility compliance activities from the Marine Information 
for Safety and Law Enforcement (MISLE) database, which is the agency's 
primary data system for documenting facility oversight and other 
activities. As discussed later in this report, we identified some problems 
with the data, and worked with agency officials to address these problems 
to the extent possible. To assess the reliability of the data, we (1) 
performed electronic testing for obvious errors in accuracy and 
completeness; (2) reviewed related documentation, such as guidance for 
entering data in MISLE; and (3) held meetings and exchanged 
correspondence with Coast Guard information systems officials to discuss 
data entry and analysis and ensure correct identification of specific data 
fields. We removed 77 records that Coast Guard indicated to be duplicate 
records, created a dataset linking deficiencies and enforcement actions 
and worked with Coast Guard to reduce data inconsistencies, and created 
a new "Sector" field based on Coast Guard identification of the 
appropriate sector. Based on the steps we took to assess data reliability 
and our work with Coast Guard officials to resolve problems with the data, 
we found the data to be sufficiently reliable to provide a general indication 
of Coast Guard compliance activities. We also reviewed a variety of 
documents, such as pertinent MTSA provisions, as amended, and their 



Coast Guard completed realignment of its field structure in 2006 into 35 sectors based on 
existing Captain of the Port boundaries. Sectors combine legacy Marine Safety Offices, 
Groups, Vessel Traffic Services, and some Air Stations into a unified command structure. 
These seven sectors were selected to reflect diversity in size, type of waterway, and 
geographic location, and facilities were selected to reflect sector diversity. Information on 
Coast Guard's inspection program from these sectors cannot be generalized to all Coast 
Guard sectors. 
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implementing regulations, Coast Guard circulars, and reports related to 
port security. A more detailed description of our scope and methodology 
is contained in appendix I. 

We conducted this performance audit from May 2006 through February 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 



RGSllltS in Brief Although the Coast Guard has conducted thousands of inspections at 

MTSA facilities and identified facility deficiencies in about one-third of 
those inspections, we could not confirm whether the Coast Guard has 
fulfilled its annual compliance exam requirement each year because the 
Coast Guard's database cannot identify all regulated facilities in prior 
years that the Coast Guard was required to have inspected. Based on the 
number of facility security plans approved by the Coast Guard, officials 
estimated that about 3,200 facilities require inspection. Coast Guard 
compliance records indicate 2,126 annual inspections were conducted in 
2006. Headquarters officials said field units reported that all required 
facility annual inspections were conducted, as did officials in the seven 
sectors we visited. However, officials also stated that some inspections 
conducted may not have been recorded, or inspections were delayed 
beyond the end of the year by staff being diverted for higher-priority 
missions, such as natural disasters. In addition to the annual exam, our 
analysis shows that Coast Guard units had been performing spot checks 
prior to the SAFE Port Act's passage, but not at all facilities. In calendar 
year 2006, for example, the Coast Guard conducted about 4,500 spot 
checks at about 1,200 MTSA facilities. The top categories of deficiencies, 
collectively accounting for about 35 percent of all recorded deficiencies in 
2006, were access controls (such as unlocked gates) and documentation 
(such as not recording a security exercise). In over 80 percent of the cases, 
deficiencies were resolved by facility operators without the Coast Guard 
applying formal action, such as a written warning or fine. Our analysis 
showed differences in the extent to which individual Coast Guard units 
took formal enforcement actions. 

The Coast Guard believes it has sufficient numbers of inspectors to 
conduct all required inspections, but additional factors could affect the 
Coast Guard's estimates of the number of inspectors needed. Headquarters 
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officials said their assessments of the number of inspectors needed were 
based largely on estimates of such things as number of facilities and time 
needed to conduct inspections. Coast Guard headquarters has not 
assessed the reliability of these estimates and our field visits identified two 
potential factors that were not taken into account in making these 
estimates. First, staff assigned to inspector positions may not be available 
full time to conduct security inspections because they have other 
responsibilities. In all seven sectors we visited, inspectors said they had 
other duties — such as inspecting cargo or monitoring safety and pollution 
incidents. However, the Coast Guard does not have data on how 
inspectors' time is allocated. In four of these sectors, inspectors reported 
to us that meeting the combined responsibilities was a challenge that 
could affect their ability to conduct all required inspections. Second, 
inspection requirements themselves have recently changed, and these 
changes could affect the amount of time needed to complete inspections. 
Until recently, the Coast Guard did not have guidance specifying how spot 
checks were to be conducted. We found considerable variation among 
sectors in the extensiveness of these spot checks. Some units, for 
example, counted visual drive-bys as spot checks, while others required an 
on-site presence. As our fieldwork was being completed, the Coast Guard 
issued guidance calling for a more detailed review than took place for 
some spot checks in the past. Coast Guard officials did not know what 
effect these new inspection requirements will have on the inspection 
workload. 

The Coast Guard has not assessed the effectiveness of its facility oversight 
program, and flaws in data in MISLE, the Coast Guard's main database for 
inspections, limit the Coast Guard's ability to accurately portray and 
appropriately target oversight activities. Basic guidance provided by 
headquarters officials grants considerable discretion to local Coast Guard 
units in deciding how to conduct facility oversight — for example, deciding 
whether a fine is warranted. The Coast Guard has little or no information, 
however, on which approaches work better than others. Our past work 
has shown that high-performing organizations continuously assess their 
performance with information about results based on their activities. The 
Coast Guard is limited in its ability to accurately assess facility oversight 
activities because its MISLE database suffers from such problems as 
missing, duplicate, and inconsistent compliance activity data. Accurate 
and complete data are a key component of any assessment of compliance 
activities and for management purposes at both the headquarters and local 
levels. Compliance data flaws make it difficult to produce consistent 
statistics important for an overall assessment of facility oversight activities 
and to conduct critical analyses. For example, officials in the seven Coast 
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Guard sectors we visited said that although MISLE data are useful in 
tracking an individual facility's performance, the data are of limited use in 
creating useful and reliable reports across multiple facilities. At the 
headquarters level, the Coast Guard is hampered in evaluating compliance 
activities, such as comparing the extent to which various units levy fines 
or discover various types of deficiencies. Recent Coast Guard guidance 
calls for improved MISLE data entry; however, changes made as a result of 
the guidance are not yet known, and the guidance does not address other 
MISLE compliance data flaws such as lack of consistency in the data. 

We recommend that the Secretary of the Department of Homeland 
Security direct the Coast Guard to improve its facility inspection program. 
Specifically, we recommend that the Coast Guard be directed to: 

• reassess the adequacy of staff to complete required inspections in light 
of changing inspection guidance regarding how inspections are 
conducted, 

• assess the effectiveness of differences in program implementation, and 

• assess its MISLE compliance data reliability and identify strategies for 
more effective use of the data. 

The Department of Homeland Security concurred with our 
recommendations. 



Background ^ e i m P or tance and potential vulnerability of our nation's ports are well 

" documented. National ports and waterways are responsible for moving 

over 99 percent of the volume of overseas cargo, with over $5.5 billion 
worth of goods moving in and out of U.S. ports every day, according to the 
American Association of Port Authorities. With more than half of the 
crude oil and all of the liquefied natural gas used in the country in 2005, 
any disruption in the flow of commerce could have major economic 
consequences. As vital as ports are to the country, they are susceptible to 
terrorist acts due to their size and openness — easily accessible by water 
and land and are attractive targets given the proximity of many ports to 
urban areas and collocation with power plants, oil refineries, and other 
energy facilities. 

Efforts to address port vulnerabilities face the challenge of having to 
consider the impact that an increase in security may have on the operation 
of commerce and the impact on maritime facility operators of costly 
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security requirements. Particularly with "just in time" deliveries, which 
rely on the quick movement of goods, steps added to the process to 
increase security may have economic consequences. 7 Actions to improve 
security are undertaken with the knowledge that total security cannot be 
bought no matter how much is spent on it because of the difficulty of 
anticipating and addressing all security concerns. 



MTSA Establishes Security MTSA established a framework to help protect the nation's ports and 
Measures for Maritime waterways from terrorist attacks by mandating a wide range of security 

Facilities improvements. Among the major requirements included in MTSA were 

those related to facilities located in, on, under or adjacent to waters 
subject to the jurisdiction of the United States that the Secretary of DHS 
believes may be involved in a transportation security incident. 8 MTSA and 
Coast Guard implementing regulations establish requirements for owners 
and operators currently at about 3,200 select port facilities. 9 In general, 
facilities that receive vessels that carry large or hazardous cargo, vessels 
subject to international maritime security standards, selected barges, and 
passenger vessels certified to carry more than 150 passengers are subject 
to MTSA regulations. 

Owners or operators of facilities subject to MTSA regulations (MTSA 
facilities) were required, among other things, to designate a Facility 
Security Officer (FSO), ensure that a facility security risk assessment was 
conducted, and ensure that a facility security plan was approved and 
implemented. The basic aim of such plans is to develop measures to 
mitigate potential vulnerabilities that could otherwise be exploited to kill 
people, cause environmental damage, or disrupt transportation systems 
and the economy. Facility Security Plans (FSP) encompass a range of 
security activities, such as access controls and security training to prevent 
a security incident. MTSA and its regulations set out requirements that are 
performance-based rather than requiring specific procedures or 



7 The concern with the cost to facility operators was considered when MTSA regulations 
were drafted, and grant funding was made available to support some facilities with security 
improvements. 

8 Other MTSA requirements included vulnerability assessments for ports and vessels, 
developing a maritime transportation security card to help control access to secure areas, 
and establishing a process for assessing foreign ports from which vessels depart for the 
United States. 

9 See, e.g., 33 C.F.R. Chapter 1, Subchapter H. Vessels regulated under MTSA regulations 
include for example, specified types of cargo ships, ferries, and tugs and barges. 
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equipment, thus allowing flexibility for meeting the law's requirements. 
For example, a facility's plan must include measures to control access to 
the facility, but how access should be specifically controlled is not 
mandated by MTSA or its implementing regulations. 

The Coast Guard is largely responsible for administering MTSA 
requirements. For facilities, in addition to issuing regulations, the Coast 
Guard is responsible for review and approval of facility security plans, 
ensuring that facilities implement the plans, verifying that facilities 
continue to adhere to their plans, and for re-approving facility security 
plans periodically, which were established by Coast Guard regulations as 
valid for 5 years. The Coast Guard reported that security plans required for 
over 3,000 MTSA facilities as of July 1, 2004 were approved, and that it had 
verified that these plans were in place by December 31, 2004. With the 5- 
year approval of facility security plans complete, the focus shifted to 
ensuring continued compliance with security measures that have been 
implemented. 

We reviewed the Coast Guard's early MTSA implementation and identified 
short- and long-term challenges to the Coast Guard's May 2004 strategy for 
monitoring and overseeing security plan implementation. Key concerns 
were how the Coast Guard planned to ensure that enough inspectors were 
available, that they would have a training program sufficient to overcome 
major differences in inspector experience levels, and that inspectors 
would be equipped with adequate guidance to help conduct thorough, 
consistent reviews. Further, we reported that the Coast Guard faced the 
challenge of ensuring that owners and operators continue implementing 
their plans and do not mask security problems in ways that do not 
represent the normal course of business. In this regard, our work has 
shown that there are options the Coast Guard could consider beyond 
regularly scheduled visits, such as unscheduled, unannounced visits, and 
covert testing. We recommended that the Coast Guard evaluate its initial 
compliance efforts and use the information to strengthen the compliance 
process for its long-term strategy. 



Coast Guard activities related to MTSA facility security plan approval and 
facility oversight are captured in the Coast Guard's MISLE database. 
MISLE began operating in December 2001 as the Coast Guard's primary 
data system for documenting marine safety and environmental protection 
activities. Storage of data on MTSA facility oversight and that of other 
Coast Guard activities, such as vessel boardings and incident response 
have since been added. The purpose of MISLE is to provide the capability 



MISLE Database Adapted 
to Capture MTSA 
Compliance Data 
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to collect, maintain, and retrieve information necessary for the 
administration, management and documentation of Coast Guard activities. 
Data on facilities are entered by inspectors on an intranet website using 
dropdown menus and narrative fields related to a specific compliance 
activity. The information maintained in MISLE is varied, as shown by the 
entry screen reproduced in figure 1. 



Figure 1 : Example of Activities Entered into the Coast Guard's MISLE Database 
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a 












Vessel Inspection 


Facility Inspection 




Vessel 8oarding 




Investigation 




Fishing Vessel Exam 


4 

Platfoim Inspection 




SAR Sortie 




I mpose Vessel Operational 
Control 














u& 




Courtesy Marine Exam 


Cargo Transfer Monitor 




Migrant Operations 




Enforcement Activity 














T owing Vessel Exam 


Cargo/Container Inspection 




Pollution Response 


Home 











Source: MISLE User's Guide. 



Limitations in Coast Guard's compliance database preclude it from being 
able to document whether all facilities received an annual exam each year. 
Coast Guard officials said field units report that they are meeting their 
inspection requirements, but inspections may not be documented in the 
compliance database, or inspections may have been delayed by staff being 
diverted to meet higher-priority needs. The available data indicate that the 
Coast Guard also conducted many spot checks, but prior to the SAFE Port 
Act's requirement for an annual unannounced inspection of each facility, 
these spot checks were concentrated in about one-third of regulated 
facilities. The types of deficiencies identified most often during annual 
exams and spot checks fell into five main categories, with the top two 
categories — not adhering to facility plans regarding access controls (such 
as gates and fences) and lack of documentation (such as no record of 
drills) accounting for over a third of deficiencies. Relatively few facilities 
in the Coast Guard sectors we visited had many or substantial deficiencies, 



Whether All Facility 
Inspections 
Requirements Were 
Met Is Not Clear, but 
Those Conducted 
Identified 
Deficiencies with 
Facility Compliance 
in about One-Third of 
All Inspections 
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and Coast Guard officials provided anecdotal evidence that security had 
generally improved over time. The Coast Guard sectors varied in the 
extent to which they resolved deficiencies using formal enforcement 
actions such as written warnings or fines, although overall over 80 percent 
of deficiencies were resolved without formal actions. 



Coast Guard Officials 
Report Annual Exams and 
Spot Checks Have Been 
Conducted, but Extent to 
Which All Regulated 
Facilities Have Received 
Both Inspections Cannot 
Be Documented 



Coast Guard officials at headquarters and the sectors we visited reported 
MTSA facilities subject to maritime facility inspection requirements were 
being inspected. At sectors we visited, Coast Guard officials based this 
assessment on data from MISLE supplemented by knowledge of facilities 
under their jurisdiction. 10 Sector officials, like headquarters officials, 
cannot use MISLE to identify all facilities that were subject to inspection 
because of flaws in the MISLE database. Some sectors mentioned that they 
also maintained local spreadsheets documenting exams. Headquarters 
officials said that they based their assessment on information requested 
from field units regarding whether the units were meeting annual exam 
requirements, although they acknowledged that there were some 
situations in which annual inspections might not have been conducted 
within the year. Reasons this official and others cited for some facilities 
possibly not receiving an exam during 2006 included the following: 

• Inspectors were diverted to a higher-priority mission. Officials said that 
activities conducted after Hurricanes Rita and Katrina disrupted 
inspection activities in the areas affected by the hurricanes and 
diverted Coast Guard resources from other regions. In the Upper 
Mississippi River sector, officials similarly reported inspectors being 
detailed to respond to floods in North Dakota. One inspector said it 
took an additional 6 months to complete on-the-job training needed be 
certified as an inspector because of the time she spent detailed away 
from the sector. 



MISLE data may not reflect all the annual exams that were conducted. 
For example, officials said that an annual compliance exam could have 
been conducted while inspectors conducted a pollution inspection, but 
the activity was only entered as a pollution inspection. No information 
was available to identify annual exams conducted but not recorded. 



Throughout this report, the terms "MISLE," "MISLE data," and "MISLE database" refer to 
data from just the MTSA facility compliance portion of MISLE. 
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Definitive information about the extent to which all facilities were 
inspected is not available, because the Coast Guard's MISLE database 
does not have the capability to document the extent to which MTSA 
facilities received an annual inspection for a particular year. The database 
can identify which facilities received annual exams in a particular year, 
but it cannot identify those facilities that did not receive exams but should 
have. Our analysis of MISLE data on the number of exams reported, 
however, indicates the total is less than the number of facilities the Coast 
Guard believes it is regulating. The Coast Guard estimates the number of 
MTSA facilities at about 3,200 nationwide, based on the number of facility 
security plans currently approved. Our analysis of MISLE data indicated 
2,126 facilities received exams during 2006. 11 

Coast Guard data show that prior to the SAFE Port Act's requirement that 
each facility receive an unannounced inspection, Coast Guard units were 
conducting unannounced spot checks, but not at every facility. MISLE 
data indicate the Coast Guard conducted about 4,500 spot checks in 2006, 
covering about 1,200 facilities. The pattern was similar in 2005, the first 
full year of facility oversight (see fig. 2). The SAFE Port Act's requirement 
for each facility to receive two inspections was not effective until October 
2006. 



After completion of our analysis, but before this report was issued, Coast Guard reported 
identifying an additional 344 annual exams that were conducted in 2006, and said that they 
were investigating why these exams were not previously identified and included in the data 
GAO was provided. 
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Figure 2: Recorded Security Spot Checks Performed by the Coast Guard in 2004, 
2005, and 2006 and Number of Facilities Receiving Spot Checks 
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1 MISLE data 

Source: GAO analysis of Coast Guard MISLE data. 

Coast Guard officials said that, prior to the SAFE Port Act's new 
unannounced inspection requirement, units used a combination of risk 
and convenience to decide which facilities should receive spot checks. As 
a result, some facilities received a number of checks in a year's time, while 
others received none. For example, Coast Guard officials at two sectors 
said if inspectors are frequently at a facility to examine arriving vessels, 
they also have an opportunity to conduct a spot check of the facility's 
security measures. Several sectors we visited mentioned that they had a 
goal, even before the new requirement took effect, of spot checking every 
facility, but officials at these sectors said the risk-based approach took 
precedence, leading to numerous checks at facilities with higher risk. 

Given the resources provided in DHS fiscal year 2007 appropriations, 
related Coast Guard allocations, and the number of spot checks conducted 
in prior years, Coast Guard officials said they expect sectors to meet — and 
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likely exceed — the spot-check requirements. 12 At sectors we visited where 
additional staffing resources (temporary reservists and permanent staff) 
were in place, local officials generally agreed with this assessment. At a 
sector that did not receive additional permanent staff, however, officials 
said they were still determining how to meet the SAFE Port Act inspection 
requirements after temporary staff were gone. 



Deficiencies Identified in 
about One-Third of 
Facilities and Most Were 
Addressed without Formal 
Coast Guard Enforcement 
Action 



The Coast Guard identified deficiencies in about one-third of the facilities 
inspected in 2004-2006, with deficiencies concentrated in a subset of five 
deficiency categories, for example, failing to follow facility security plans 
for access control. Facilities with many or substantial deficiencies were 
relatively few in number, and deficiencies were identified during both 
annual exams and spot checks. The extent to which formal enforcement 
actions were used was limited nationally, but varies greatly among Coast 
Guard sectors. The majority of deficiencies were addressed by the Coast 
Guard informally, without formal enforcement actions. 



Facility Deficiencies Were 
Concentrated in Five 
Deficiency Categories 



Thirty-six percent of the facilities that the Coast Guard documented as 
receiving an annual compliance exam or a spot check in 2006 had at least 
one reported deficiency, according to our analysis of information in 
MISLE. The previous 2 years were similar, with rates of 30 percent each 
year. These figures may not include security weaknesses that are 
corrected on the spot. Headquarters and sector officials told us that, in 
keeping with Coast Guard policy allowing the practice, inspectors may 
choose not to record such deficiencies. For example, a facility security 
officer at one oil facility said the Coast Guard gave him a verbal warning 
about the failure to display credentials at entrance gates and maintaining 
better documentation of security drills conducted at the facility. Similarly, 
the security officer at a gypsum facility said inspectors had suggested 
more creativity in crafting facility exercise scenarios (which the facility 
official said he would try to do) but inspectors had not recorded a 
deficiency. 



About 70 percent of the 2,500 reported deficiencies identified in 2006 
occurred in five categories: access control (such as fences or gates 
needing repair), recordkeeping requirements, security for restricted areas 



This expectation, however, was based on spot checks conducted prior to Coast Guard 
guidance (discussed in the following section) that establishes a more comprehensive 
review than was the case for some of the previously conducted spot checks. 
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(such as not posting required signs), drill and exercise requirements, and 
facility security plan amendment (for example failing to get approval for 
changing a security measure) and deficiencies related to the facility 
security plan or conducting a facility security audit. As figure 3 indicates, 
the two top categories, with over one-third of the deficiencies, were access 
control and facility recordkeeping requirements. 13 



Figure 3: Facility Deficiencies Identified in 2006 by Coast Guard Inspections 

Security measures for access control 

I Facility recordkeeping requirements 




Security measures for restricted areas 



Drill and exercise requirements 



Facility Security Plan amendment and 
audit requirements 



1 All other deficiencies 

Source: GAO analysis of MISLE data. 

Access and documentation were also the most common types of 
deficiencies at the sectors we visited. Table 1 provides examples of 
deficiencies in these two categories from the sectors we visited. As the 
examples illustrate, each category can include a variety of violations. 
Similar deficiencies were reported by officials at facilities we visited 
within the seven sectors. Examples included not constructing a new fence 
after a tornado; not screening vehicles, persons, and personal effects; 
leaving a gate unlocked; not completing exercise requirements; and lack of 
timeliness in documenting training. 



These categories correspond to the types of facility responsibilities cited in the Coast 
Guard's MTSA regulations. See appendix II for a more detailed description of deficiencies 
and the numbers of deficiencies by category, for 2004, 2005, and 2006. 



Page 14 



GAO-08-12 Maritime Security 





Table 1 : Deficiency Narrative Examples in 2006 from Selected Sectors Visited by GAO in the Top Two Nationwide Deficiency 
Categories 


Sector 


Security measures for access control 


Facility recordkeeping requirements 


Sector A 


Restricted area fence damaged by storm 1 week prior to 
inspection. Provide work order for repair prior to 1 week from 
date of inspection. 


Show proper documentation of annual facility security plan 
audit. 


Sector B 


Facility inspectors found an open gate near the rail that had 
no security measures in place. 


FSO did not provide certified letter of annual audit. 


Sector C 


Fencing was damaged/pulled away from posts in several 
locations diminishing access control. 


Documentation not available on training for personnel with 
security duties and personnel without security duties, and 
drill and exercise requirements. 


Sector D 


Not screening by hand or device such as x-ray, all 
unaccompanied baggage prior to loading onto facility. 


No maintenance, calibration, and testing of security 
equipment logs were able to be produced. 


Sector E 


No narrative available. 


Drill and exercise records not in FSP specified format or 
available for Coast Guard inspection. 


Sector F 


Signage describing security measures is not in place. Put 
sign describing security measures in place. 


Facility has no records of facility personnel with security 
duties. 


Sector G 


FSO greeted inspection team and granted them access to 
facility without checking ID. 


No lessons learned were recorded for the drills. 



Source: Coast Guard MISLE data verbatim narrative descriptions of facility deficiencies. 



Our visits to facilities in the seven sectors also disclosed instances in 
which a regulated facility's access controls would not prohibit access from 
a neighboring facility. We observed four instances in which a neighboring 
facility's building or stacked-up materials would facilitate entry over a 
regulated facility's perimeter fencing. Figure 4 shows one of those 
instances. 14 After we pointed out these weaknesses to Coast Guard 
officials, they assured us that the weaknesses would be corrected. Coast 
Guard officials told us that any vulnerabilities introduced by neighboring 
facilities (whether the neighboring facility is a MTSA facility or not) should 
be identified in a facility's vulnerability assessment, then addressed in a 
facility's security plan. 



14 Coast Guard officials have pointed out that areas may be covered by surveillance systems 
that would reduce the risk of entry. In one location where a building was next to the 
perimeter, the facility FSO said cameras were being added (in addition to existing security 
patrols) to improve visibility in this area. 
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Figure 4: Example of Neighboring Facility Conditions Facilitating Entry into a 
MTSA-Regulated Facility 




Source: GAO. 



While about one-third of all facilities had at least one deficiency identified 
and recorded during an annual inspection or spot check, deficiencies in 
the seven sectors we visited tended to be concentrated in relatively few 
facilities. According to MISLE data, five or fewer facilities accounted for 
an average of 61 percent of deficiencies in six of the seven sectors we 
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visited, and 10 or fewer facilities accounted for an average of 80 percent. 15 
One facility that receives passenger vessels in one sector we visited was 
cited for 12 deficiencies during its annual compliance exam. This facility's 
deficiencies related primarily to (1) lack of knowledge about security 
procedures or equipment on the part of the security officer or other 
personnel and (2) failure to conduct or document security drills and 
exercises. 

Coast Guard officials at the sectors we visited said they thought security 
awareness and procedures had improved in the years since MTSA's 
inception. Atlantic Area Coast Guard officials cited MTSA as making a 
difference in reducing cargo loss as increased security procedures lower 
theft rates. Officials cited qualitative changes such as the following: 

• facilities taking more ownership of their own security and being more 
aware of security concerns, 

• fewer trespassers on waterfront property and increasing security 
awareness among maritime workers, 

• decrease in vandalism as a result of additional cameras in port areas 

• more informed security personnel, and 

• improved communication with facilities regarding break-ins. 

Our analysis of the top deficiencies included in the Coast Guard's database 
showed that Coast Guard inspectors identified deficiencies both in spot 
checks and in annual exams, but spot checks tended to identify 
deficiencies related to access control and control over restricted areas. As 
table 2 shows, spot checks accounted for 44 percent of all recorded access 
control deficiencies and 19 percent of restricted area deficiencies, but no 
more than 9 percent of the other most common categories of 
deficiencies — drills, recordkeeping, and plan amendment/audits. This may 
occur because spot checks are sometimes conducted external to the 
facility and do not involve checking records, drills, or plans. 16 



3 In the seventh sector, the top 5 facilities accounted for 18 percent of all deficiencies, and 
the top 10 accounted for 32 percent. 

16 Recent spot check guidance indicates that less emphasis should be placed on items that 
would not change between annual compliance exams, such as drill/exercise records. 
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Table 2: Top Five Facility Deficiencies Recorded Nationwide in 2006 


Deficiency category 


Deficiencies 


Percent identified 
during annual exam 


Percent identified 
during spot check 


Percent identified 
during other activities 9 


Drill and exercise requirements 


269 




92 


7 


1 


Facility recordkeeping requirements 


418 




94 


6 





Security measures for access control 


458 




50 


44 


6 


Security measures for restricted areas 


364 




79 


19 


2 


Facility Security Plan amendment and audit 


243 




90 


9 


1 


U.S. Total for top five deficiencies 


1,752 




78 


19 


3 



Source: GAO analysis of Coast Guard MISLE data. 

"Includes monitoring of facility security plan exercises and other oversight activities. 



We attempted to compare deficiencies identified during announced or 
unannounced annual compliance exams, but until July 2007, activities in 
the database were not required to indicate whether an exam was 
announced or unannounced. Headquarters officials acknowledged that 
there is variation in whether sectors conduct these exams announced or 
not, but could not provide information for all sectors that would allow a 
comparison. 17 Furthermore, the Coast Guard has not assessed the 
effectiveness of each approach to establish whether one approach is more 
effective in identifying deficiencies. 

Informal Enforcement Actions Inspectors told us they generally use Coast Guard guidance in deciding 
Generally Used for whether to issue some form of formal enforcement action, taking into 

Deficiencies, but Use Varied consideration the facility's deficiency history and the risk associated with 
among Sectors Visited the violation. Several Coast Guard sector officials said the Coast Guard 

prefers to work cooperatively with facilities to improve security 
procedures, instead of taking an adversarial or punitive approach. They 
said they often give facilities several weeks during which to fix a 
deficiency, instead of issuing an immediate enforcement action. 

Most often, a formal enforcement action, such as issuing a letter of 
warning, a notice of violation, or a civil penalty such as a fine, is not 
applied. Our analysis of MISLE data indicates that inspectors took one of 
these formal actions in about 11 percent of recorded deficiencies in 2004, 
19 percent in 2005, and 16 percent in 2006. Table 3 shows what types of 



Toward the end of our work, the Coast Guard issued a Commandant's message requiring 
information be entered into MISLE regarding whether the exam was announced or not. 
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enforcement actions were recorded for the top five deficiencies in 2006 
and a total for all deficiencies in 2006. Based on MISLE data, of the top five 
deficiencies, access control was most likely to result in an enforcement 
action. For this type of deficiency, formal action occurred 25 percent of 
the time. 



Table 3: 2006 Nationwide Enforcement Actions Recorded for Top Five Deficiencies and All Deficiencies 



Deficiency category 


Deficiencies 


Letter of 
warning 
issued 


Notice of 

violation Civil penalty 
issued issued 


Percent of cases in 
which enforcement 
action was issued 


Security measures for access control 


458 


31 


57 


28 


25 


Facility recordkeeping requirements 


418 


15 


4 


7 


6 


Security measures for restricted areas 


364 


11 


22 


5 


10 


Drill and exercise requirements 


269 


4 


18 


6 


10 


Facility Security Plan amendment and audit 


243 


8 


9 


7 


10 


Total for top five deficiencies 


1,752 


69 


110 


53 


13 


Total for all deficiencies 


2,513 


115 


181 


96 


16 



Source: GAO analysis of Coast Guard MISLE data. 



Our analysis of MISLE data shows sectors varied in the extent to which 
enforcement actions were taken. Coast Guard officials said that sector 
management is given discretion to use or not use enforcement actions as 
year 2006, the Coast Guard's use of enforcement actions for the top five 
nationwide deficiencies in the sectors we visited. Even when the same 
deficiency is recorded, the sectors we visited vary greatly in whether or 
not they issued an enforcement action. For example, the first sector 
shown in the table took no enforcement actions, while the second sector 
used enforcement actions in each of the five deficiency categories. Our 
analysis could not determine the reasons for these differences, such as 
whether the variations reflect different circumstances faced by sectors, 
nor could Coast Guard officials explain the differences. 
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Table 4: 2006 Enforcement Actions Recorded in Selected Sectors for Top Five Recorded Deficiencies 



Sector 


A 


B 


C 


D 


E 


F 


G 


Total of 
Selected Sectors 


Drill and exercise requirements 


Number of deficiencies 


7 


4 


10 


4 


4 


34 


7 


70 


Percent of cases in which enforcement action was issued 





100 


60 


75 


75 


15 





30 




Facility recordkeeping requirements 


Number of deficiencies 


7 


16 


8 


2 


8 


58 


19 


118 


Percent of cases in which enforcement action was issued 





31 


13 


100 


38 


5 





12 




Security measures for access control 


Number of deficiencies 


9 


17 


25 


3 





7 


4 


65 


Percent of cases in which enforcement action was issued 





41 


40 


67 




29 


100 


38 




Security measures for restricted areas 


Number of deficiencies 


18 


7 


3 








12 





40 


Percent of cases in which enforcement action was issued 





57 


33 











13 




Facility Security Plan amendment and audit 


Number of deficiencies 


6 


5 


6 





7 


16 


10 


50 


Percent of cases in which enforcement action was issued 





60 







43 


13 





16 



Source: GAO analysis of Coast Guard MISLE data. 



The Coast Guard's assessments of the number of inspectors needed to 
meet facility inspection requirements were based on limited data, and 
since these assessments were conducted, additional factors have arisen 
that could also affect the number of inspectors needed. The original 
assessment for meeting MTSA requirements and the subsequent 
assessment for meeting additional SAFE Port Act requirements were both 
estimates that were based on limited information, and the Coast Guard has 
not assessed their reliability. Moreover, our field visits identified two 
factors that could affect the estimates. One is that persons in inspector 
positions have other responsibilities that may compete with conducting 
inspections, so that the amount of time available for inspections may be 
less than expected. The Coast Guard does not have data on what portion 
of inspectors' time is actually available for conducting inspections. The 



Data Used in Coast 
Guard's Assessments 
of Number of 
Inspectors Needed 
Were Limited and 
Results Could Be 
Affected by 
Additional Factors 
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second factor is that recently issued guidance for conducting 
unannounced spot checks may require inspectors in some locations to 
spend more time conducting these spot checks than they had spent in the 
past. Coast Guard officials do not know what the effect of the new spot 
check requirements will be on resources needed. 



Coast Guard Believes It 
Has Sufficient Inspectors, 
but Its Estimates Were 
Based on Limited Data 



Although Coast Guard officials said the number of Coast Guard inspectors 
is adequate, their basis for determining the number of inspectors needed, 
both for the initial implementation of MTSA and to meet SAFE Port Act 
inspection requirements, was limited in several respects. When we 
reviewed the approach the Coast Guard used to project staff needed for 
meeting MTSA inspection requirements, we found the Coast Guard did not 
have a great deal of workload data to use in estimating the additional staff 
needed, nor did it have a system in place for determining how much time 
its personnel are spending on specific duties. 18 The Coast Guard told us it 
established its estimates for the number of inspectors needed using 
working groups, panels, and available data, including information about 
resources in port security missions since the September 11, 2001, terrorist 
attacks. 19 The estimates were also based on experience with environmental 
and safety inspections, but whether those types of inspections were 
analogous was unclear. Further, the Coast Guard could not provide 
documentation of the approach it used, limiting its ability to assess the 
adequacy of its decision. We determined that the Coast Guard had a basis 
for its estimate, but also that its approach stopped short of providing 
demonstrable evidence of its validity. The Coast Guard did not assess how 
reliable this estimate was in meeting inspection needs, but officials noted 
that sector officials could provide headquarters with feedback on their 
needs and request additional staff. 



The approach the Coast Guard used for estimating the number of 
additional inspectors needed to meet SAFE Port Act requirements had 
similar limitations. Coast Guard officials said they also used a general 
formula to request funding for personnel to conduct these additional 
inspections. They said they had limited time to prepare the request, and 
estimated the number needed based on past experience by looking at the 
number of inspections currently being conducted and the current number 



19 The Coast Guard added 282 positions to local marine safety offices to meet MTSA facility 
inspection requirements. 
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of inspectors, plus input from Coast Guard area officials. An additional 39 
positions were added with resources stemming from DHS fiscal year 2007 
appropriations. 20 

Other than field unit feedback, Coast Guard officials do not currently have 
a means for determining whether the deployment of staff to inspection 
positions is sufficient. In 2004 we recommended that the Coast Guard 
formally evaluate its facility inspection program to look at the adequacy of 
security inspection staffing, among other things; however, Coast Guard 
has not done so. Officials discussed using an existing management tool in 
combination with revised training requirements and staffing standards to 
be developed in the future as a way to measure the adequacy of staffing for 
specific mission areas, but as yet had no estimated date for completion of 
this effort. 



One factor that may affect the accuracy of the estimates is that inspectors 
are also responsible for a variety of other duties, and the extent to which 
these inspectors are available to conduct security inspections is unclear. 
Coast Guard data indicate that about 600 personnel have been qualified to 
conduct MTSA facility inspections. Officials said that as of August 2007 the 
Coast Guard had 389 MTSA positions, including the 39 new positions 
added with resources stemming from DHS fiscal year 2007 appropriations 
for unannounced spot checks, and, most of the positions were filled. 21 
Besides these personnel, a July 2007 Commandant message, indicated that 
Coast Guard districts were authorized to use reservists on a short-term 
basis to meet inspection requirements. In all, 52 reservist positions were 
authorized for this purpose. 

Our field visits showed that staff assigned to inspector positions were not 
necessarily working as inspectors, and those that were conducting 
inspections were also performing a number of other mission tasks as well. 
Data on the extent to which personnel in inspector positions are actually 



Comments provided by the Coast Guard in January 2008 to a draft of this report stated 
that the Coast Guard is receiving an additional 25 facility inspectors positions to increase 
its ability to meet the SAFE Port Act mandate. Positions are expected to be filled during the 
2008 summer transfer and assignment season. 

21 The Coast Guard provided data on the number of personnel with MTSA Facility 
Inspection qualifications. These may include personnel assigned to other types of positions, 
such as logistics or a strike team. Officials noted that personnel may be qualified for a 
number of different positions. See appendix I for further discussion. 



Extent to Which 
Inspectors Are Available 
for Inspection Duties Is 
Unclear 
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conducting facility inspections are not available. Coast Guard 
headquarters officials said it was difficult to know the extent to which an 
inspector was inspecting MTSA facilities because of the flexibility in how 
staff are used. 22 Each sector, they said, determines what is needed for its 
workload. In all seven sectors we visited, staff in inspector positions were 
responsible for tasks other than facility inspections. Other tasks included 
responding to pollution incidents, supervising the handling of explosive 
cargo, monitoring the transfer of oil, conducting harbor patrols, boarding 
vessels, and conducting inspections of vessels or other matters, such as 
safety or environmental concerns (see fig. 5). 



Officials said inspectors can be assigned elsewhere temporarily, for a day or placed full- 
time in non- inspection billets based on sector needs that match their qualifications (e.g., as 
a safety inspector or Marine Science Technician). 
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Figure 5: Examples of Other Inspector Responsibilities — Harbor Patrols and Cargo 
Inspections 




Source: U.S. Coast Guard. 
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At four of the seven sectors we visited, officials said meeting all mission 
requirements for which inspectors were responsible was or could be a 
challenge, especially after reservists made available for SAFE Port Act 
inspections were no longer available. 23 

• Officials in one sector said they were meeting inspection requirements 
at the expense of other missions, such as inspecting containers or 
monitoring the transfer of oil. They said they make a risk-based 
judgment call on which activities to undertake. 

• In another sector, officials said meeting inspection requirements in the 
long term would be difficult. The new inspection requirements 
effectively doubled the required number of facility inspections, and the 
sector has received only short-term assistance. 

• Officials in another sector said available staffing could adequately 
cover only part of the sector's area of responsibility. 

• In another sector, officials said depending on the long-term workload, 
they may be seeking additional inspectors later this year, after 
temporary duty staff has left. 



Spot Check Guidance May 
Affect the Sufficiency of 
Inspectors to Conduct All 
Inspections 



A second factor that may affect the reliability of the estimates is that the 
Coast Guard based its estimate for the number of inspectors needed in 
part on the number of spot checks conducted in the past, but subsequent 
spot check guidance may require inspectors to spend more time on these 
spot checks than they had previously. After the SAFE Port Act's passage, 
Coast Guard officials initially said they did not plan to issue specific 
guidance for spot checks, because developing a single inspection form that 
encompassed all situations was difficult and because they had not heard 
from Captains of the Port that such guidance was needed. In July 2007, 
however, the Coast Guard Commandant issued a message to Coast Guard 



All but one of the seven sectors we visited reported receiving short-term authorizations 
for reserve personnel to assist with SAFE Port Act requirements, and all but one was 
allotted one or more full-time additional positions. Information from the sectors we visited 
are case studies representing variation in types and sizes of ports, but cannot be 
generalized to all 35 sectors. 
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Area officials that provided some spot check guidance. 24 Among other 
things, this guidance: 

• Defines minimum requirements for security spot checks — for example, 
specifying that the inspector must confirm that the facility is compliant 
with unique requirements for specific types of facilities (such as cruise 
ships) and must provide the facility with documentation of the 
inspection. 

• Identifies activities that do not meet the requirements for a security 
spot check, such as inspections from a vehicle or checks conducted 
while performing certain shoreside patrols or facility visits related to 
vessel boardings (unless the minimum security spot check 
requirements are met during the patrols or boardings). 

• Specified codes for documenting facility inspections in the MISLE 
database. 

Our discussions with sector officials indicated that prior to this guidance, 
sectors varied considerably in their interpretation of what constituted a 
security check. 25 For example, one sector considered asking facility 
officials 15 to 30 minutes of knowledge-based questions as a spot check, 
while another considered a drive-by with a stop at the gate a type of spot 
check. Officials in several sectors mentioned that spot checks were 
conducted during other types of facility visits or missions, such as while 
escorting a boat, conducting a waterside patrol, or performing a vessel 
inspection. 26 For documentation, one sector reported entering a record of 
all spot checks conducted, while several others qualified that "official" 



SAFE Port Act, Waterfront Facility Security R 061821Z. U.S. Coast Guard Commandant 
message to Coast Guard Area officials, July 2007. The Coast Guard is also planning other 
guidance changes such as revising its MTSA regulations and MTSA implementation 
circular. Information was not available from the Coast Guard on specific changes or how 
theses changes might affect the need for facility inspectors. 

25 While practices varied considerably for spot checks, the inspectors and facilities in the 
sectors we visited generally reported consistency in the content and process for 
conducting annual exams following Coast Guard guidance contained in the circular 

Implementation Guidance for the Regulations Mandated by the Maritime Transportation 
Security Act of 2002 for Facilities. 

26 Coast Guard headquarters indicated some confusion among inspectors and that they may 
be using Operation Neptune Shield guidance where this type of inspection is acceptable. 
However, none of the inspectors we spoke with identified this as a source of guidance to 
them. 
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spot checks were logged — a drive by or dropping in to check on a few 
items might not be recorded. One sector said recording the check or not 
depended partly on whether a deficiency was identified during the spot 
check. 

The activities called for in this guidance have potential staffing 
implications. Based on our discussion with headquarters officials and 
inspectors in all sectors we visited, some of the activities that have been 
considered spot checks will no longer be considered adequate, such as 
observing facility security procedures from a vehicle while driving by. 
Meeting the spot check requirements under the new guidance may thus 
require more time from inspectors. This in turn may affect sector 
estimates of the level of resources needed to meet inspection requirements 
and Coast Guard goals for the number of inspections to be conducted. 27 

In Coast Guard comments on this draft, officials reported a total of 9,403 
inspections (spot checks and annual exams) were conducted in 2007, 
exceeding their internal target of 8,800 inspections. This is an increase in 
inspections from prior years. Their comment however, did not indicate 
that each facility received a spot check and an annual exam. Further, 
since the spot check guidance was not issued until July of 2007, it is not 
clear how many of the spot checks were conducted following the new 
guidance. Without this information the implications for staffing are still 
uncertain. 



The Coast Guard is also considering changing its MTSA implementation circular to 
include SAFE Port Act requirements, among other things. Coast Guard officials said they 
expected any revisions to be published in early 2008. Officials also indicated that the Coast 
Guard will be proposing a rule to change the regulations promulgated in 2003 for 
implementing MTSA. Among other things, the proposed changes would establish training 
standards for security personnel, add regulations related to the reapproval of facility 
security plans, and update existing regulations to conform to various requirements in the 
SAFE Port Act of 2006. Coast Guard officials said they are behind in their original schedule 
for updating the regulations by late 2008, but the regulations must be completed in time for 
the reapproval of facility security plans in 2009. 
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The Coast Guard Has 
Not Evaluated Its 
Facility Oversight 
Program, and 
Problems with Data 
Complicate Its Ability 
to Do So 



The Coast Guard has not assessed how its MTSA compliance inspection 
program is working. Our work across many types of federal programs 
shows that for program planning and performance management to be 
effective, federal managers need to use performance information to 
identify performance problems and look for solutions, develop approaches 
that improve results, and make other important management decisions. 
The Coast Guard's ability to assess its compliance program is complicated 
by omissions, duplications, and other flaws in the data it would most likely 
use in measuring and evaluating the effectiveness of different monitoring 
and oversight approaches. 



The Coast Guard Has Not 
Evaluated the 
Effectiveness of Oversight 
Efforts 



In 2004, when we first examined the Coast Guard's efforts to deal with 
MTSA requirements, we reported that development of a sound long-term 
strategy was a critical step in bringing about effective monitoring and 
oversight. Our work assessing such other areas as airport security and 
regulatory compliance had identified approaches for ensuring compliance 
and strengthening security. 28 These approaches included such steps as 
unscheduled and unannounced inspections, and inspections on weekends 
or after normal working hours. At the time, local Coast Guard officials said 
that unscheduled inspections would be a positive component of a longer- 
term strategy because informing owners or operators of annual 
inspections can allow them to mask security problems by preparing for 
inspections in ways that do not represent the normal course of business. 
We recommended that, after the initial "surge" involved in reviewing 
security plans and conducting the first round of inspections, the Coast 
Guard should conduct a formal evaluation of its efforts and use the 
evaluation as a means to strengthen the compliance process for the longer 
term. 



In the 1990s, a statutory management framework for strengthening 
government performance and accountability was enacted into law. In 
particular, the Government Performance and Results Act (Results Act) 
calls for an increased reliance upon program performance information in 



" GAO, Aviation Security: Further Steps Needed to Strengthen the Security of 
Commercial Airport Perimeters and Access Controls, GAO-04-728 (Washington, D.C.: June 
4,2004). 
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assessing program efficiency and effectiveness. 29 The Results Act notes 
that federal managers are seriously disadvantaged in their efforts to 
improve program efficiency and effectiveness because of insufficient 
articulation of program goals and inadequate information on program 
performance, and that spending decisions and program oversight are 
seriously handicapped by insufficient attention to program performance 
and results. Although the Results Act's provisions apply primarily to 
tracking and reporting performance at the overall agency level, the same 
sound management principles apply to management of individual 
programs such as the facility compliance program. In other work, we have 
identified instances in which agencies can use performance information to 
improve programs and results. 30 

In many of its areas of activity, the Coast Guard has devoted extensive 
attention to providing sound data on its activities and analyzing what these 
data say about what the agency is accomplishing with the resources it 
expends. In 2006, for example, we reported that for many of its non- 
homeland security programs, the Coast Guard had developed performance 
measures that were generally sound and based on reliable data. 31 Further, 
the Coast Guard was actively engaged in initiatives to help interpret these 
performance measures and use them to link resources to program results. 

The Coast Guard has not, however, applied this same approach to the 
facility compliance program. Although the Coast Guard agreed with our 
recommendation in 2004 that the agency formally evaluate its MTSA 
compliance inspection efforts and use the results as a means to strengthen 
its long-term strategy for ensuring facility compliance, it has not 
conducted such an evaluation, and has no current plans to do so. In 
comments submitted after reviewing a draft of this report, the Coast Guard 
indicated that facility security program metrics were discussed during a 
November 2007 workshop with field personnel. The comments also 



Government Performance and Results Act of 1993, Pub. L. No. 103-62, 107 Stat. 285 
(1993), as amended, requires executive agencies to develop strategic plans, prepare annual 
performance plans, measure progress toward the achievement of the goals, and report 
annually on their progress in program performance reports. 

30 See, for example, GAO, Managing for Results: Enhancing Agency Use of Performance 
Information for Management Decision Making, GAO-05-927 (Washington, D.C.: 
September 2005). 

31 GAO, Coast Guard: Non-Homeland Security Performance Measures Are Generally 
Sound, but Opportunities for Improvement Exist, GAO-06-816 (Washington, D.C.: August 
2006). 



Page 29 



GAO-08-12 Maritime Security 



indicated that the Coast Guard is developing performance goals for 
monthly review by program management. 

We asked the Coast Guard to provide documentation of any systematic 
effort to assess implementation of its facility compliance program since 
July 2004, when the agency initiated the compliance phase of MTSA 
facility oversight. Headquarters officials told us that program managers 
use MISLE to see the results of inspectors' data entries and to produce 
reports, but the Coast Guard's only formal analysis of the overall success 
of MTSA implementation was contained in its Annual Report to Congress. 32 
The information the 2005 and 2006 reports provide, which includes figures 
on the number of enforcement actions and the approximate number of 
facility security inspections the Coast Guard conducted (included in the 
2005 report only), does not include an analysis of the program's operations 
or provide a basis to determine what, if anything, might be done to 
improve its operations. The program metrics and performance goals the 
Coast Guard indicated it is developing may provide data useful for future 
assessments. 

A more thorough evaluation of the facility compliance program could 
provide information on, for example, the variations we identified between 
Coast Guard units in oversight approaches, the advantages and 
disadvantages of each approach, and whether some approaches work 
better than the others. The Coast Guard has allowed Captains of the Port 
considerable discretion in implementing facility oversight program at the 
local level, in order to meet differences in local conditions. An evaluation 
could also explore the benefits of the variations that have resulted. For 
example, an evaluation could shed light on such issues as the following: 

• Conducting annual compliance exams unannounced vs. 

scheduling them beforehand. Views we heard from different Coast 
Guard units varied on this issue. Coast Guard policy has encouraged 
the pre-scheduling of these exams, but some units have decided to 
conduct them on an unannounced basis because they believe doing so 
best captures what procedures are normally in place. At some units 
that scheduled the exams with the facility beforehand, however, Coast 
Guard officials said conducting exams unannounced would slow the 
process, because facility personnel would be less prepared with 



Annual Report on Compliance with Security Standards Established Pursuant to the 
Maritime Transportation Security Plans. Submitted in accordance with Title VIII, Section 
809(i) of the Coast Guard and Maritime Transportation Act of 2004. 
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information and because officials with the needed information might 
be absent entirely. In such situations, delays might affect the unit's 
ability to complete its inspection workload. An evaluation, done with 
accurate and sufficient data, could provide information of the 
effectiveness of various approaches. 

• The type of enforcement action to take when deficiencies are 
identified. The available data indicate that Coast Guard units vary 
considerably in the extent to which they take formal enforcement 
actions, such as fines or written warnings. Headquarters officials told 
us that they could not explain the variation or its impact on continued 
facility compliance, but that units were allowed to determine actions 
taken based on the factors involved. These variations might occur for 
several reasons. Inspectors in sectors we visited told us they rely on 
Coast Guard guidance and take other factors into consideration, such 
as the nature of the deficiency, or history of the facility. They said that 
the decision on what enforcement action is taken depends in part on 
guidance from the sector's Captain of the Port, and the judgment of the 
inspector as to the severity of the incident. For example, an inspector is 
given discretion to decide to issue a facility a fine or written warning at 
a high-volume port where the consequences for an incident are high, or 
to take no formal action because it is in a low-volume port where 
facilities are dispersed and the consequences are less severe. An 
evaluation, done with accurate and sufficient data, could analyze such 
differences as possible criteria for deciding when formal or informal 
actions are most appropriate. 

• Variation in establishing the applicable MTSA regulation for a 
specific deficiency. We observed situations in which different 
inspectors cited different MTSA regulations for the same type of 
deficiency. For example, deficiencies in which security personnel 
lacked required training were classified in two different ways — 
sometimes as noncompliance with the regulation requiring security 
personnel to be knowledgeable of security-related areas, such as 
screening, and other times as noncompliance with regulations related 
to the security officer's responsibilities. Similarly, failure to log a drill 
or exercise was sometimes categorized as noncompliance with 
regulations on drills and exercises and sometimes as a recordkeeping 
deficiency. An analysis of the differences would help managers 
determine if sectors have varying interpretations, if additional training 
is needed for facility inspectors regarding the applicability of the 
regulations, or if the regulations themselves could be improved. The 
Coast Guard plans to revise its MTSA regulations by 2009, and such an 
analysis could be instructive in that effort. 
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We are not the only independent reviewer to point out the need for such 
an evaluation. In 2006, the Office of Management and Budget (OMB) 
issued an assessment of Coast Guard performance in meeting goals for the 
Ports, Waterways and Coastal Security program, which includes MTSA 
facility oversight. 33 OMB noted that there have been no reviews indicating 
whether or how the program is achieving results. OMB emphasized the 
need for the Coast Guard to evaluate the effectiveness of its program, as 
well as to develop analytical methods and processes that provide routine 
and objective feedback to program managers. 



As we have reported in other work, performance information must meet 
users' needs for completeness, accuracy, and consistency if it is to be 
useful. 34 Other attributes that affect the usefulness of performance data 
include that measures be relevant, accessible, and of value to decisions 
made at various organizational levels. 35 In MISLE, however, data and 
database fields were missing, duplicative, and inconsistent, with data entry 
a particular concern. Specific problems we identified include the 
following: 

• Deficiency data may not be entered at all, or entered twice, officials 
said. For example, if a facility corrects a deficiency immediately, 
inspectors can decide not to include it in their report. On the other 
hand, Coast Guard data analysts acknowledged that there are duplicate 
deficiencies and enforcement actions in MISLE for example, resulting 
from the same deficiency being recorded at the sector and subunit 
levels, or lack of coordination in conducting an exam so that the 
activities are entered twice. 

• Headquarters officials said that some units are unclear about what to 
enter into MISLE, and the biggest challenge to consistent and 



The Office of Management and Budget uses a Program Assessment Rating Tool that is 
consistent with GPRA objectives as a systematic measure of agency performance across 
federal programs. The tool asks a series of questions to assess different program 
performance aspects. Agencies respond to the questions with supporting information and 
OMB establishes an overall rating for the program. The Ports, Waterways and Coastal 
Security Program received an overall rating of moderately effective (well managed, but 
needs improvement). 

34 GAO, Results-Oriented Government: GPRA Has Established a Solid Foundation for 
Achieving Greater Results, GAO-04-38 (Washington, D.C.: Mar. 10, 2004). 

35 GAO-05-927. 



Database Limitations 
Hinder Compliance 
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comprehensive data is proper data entry. Although inspectors choose 
from a standardized pick-list of enforcement action citations, the 
selection process is subjective and as we discussed earlier, a particular 
violation can fit under multiple citation categories. 

• Headquarters officials said that the citation for a deficiency is not 
always provided when inspectors enter the activity into MISLE. Not 
entering this information means that the Coast Guard has difficulty 
showing data on the basis of specific MTSA regulatory deficiencies or 
specific enforcement actions. Coast Guard officials voiced varying 
opinions about whether the deficiency citation is a required field for 
inspectors to enter in MISLE, as well as about what MISLE fields to use 
to identify security-related deficiencies and enforcement actions. 

While the data themselves may pose problems, so too do the data fields 36 
into which the data are placed. Insufficient data fields in MISLE make it 
more difficult for the Coast Guard to conduct critical analyses. We 
identified two types of analysis that were limited — comparisons across 
sectors and analysis by year. 

• Although the Coast Guard began reorganizing its field units into sectors 
in 2004 and made sectors the primary management unit, data continues 
to be entered into MISLE that cannot readily be presented by sector. 
This limitation makes assessing oversight performance, variability, and 
facility compliance by sector more difficult. 37 

• The Coast Guard cannot report the number of facilities it regulated 
under MTSA during a particular period. Although MISLE contains a 
field to indicate whether a facility is currently regulated by MTSA, it 
does not have a field for the facility's activation date. (Vessels regulated 
under MTSA do have an activation date.) Without it the Coast Guard 
cannot establish the number of facilities that have been regulated, and 
is unable to calculate a percentage of MTSA facilities that received the 
required annual compliance exam during a particular period. Coast 
Guard indicated that this is an area for improvement, but did not 
identify a specific remedy or time frame. 



A data field is a location in a data set where the same information (such as a facility 
name) for each case is entered. 

37 GAO's analysis of MISLE data by sector was possible after we created a sector field and 
manually distributed data by unit names into sector designations. 
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Reporting of MTSA Compliance Due to MISLE data limitations, we were not able to recreate annual report 
Activities Could Not Be statistics provided to Congress on Coast Guard compliance activities. 

Replicated and Is Limited in Furthermore, the annual reports did not provide a comprehensive picture 
Scope °f Coast Guard compliance activities. The Coast Guard and Maritime 

Transportation Act of 2004 38 mandated an annual report from the Coast 
Guard on the agency's MTSA compliance-related activities, and so far the 
agency has issued two reports — one covering part of 2004 and much of 
2005 (July 1, 2004 to November 17, 2005), the second covering all of 2006. 39 
According to Coast Guard officials, there is no set format for the report, 
and the type of information reported varies by reports. The report for 
2004-2005, for example, includes information about the number of annual 
compliance exams conducted, while the report for 2006 does not. Coast 
Guard officials said they did not include information about the number of 
exams conducted in 2006 as part of an effort to reduce the annual report's 
size. While figures were not provided in the annual report, the Coast Guard 
agreed that our analysis of MISLE correctly identified 2,126 annual exams 
recorded for 2006. 40 



Using three categories of information (annual exams, spot checks, and 
enforcement actions) that the Coast Guard reported for one or more of 
those years, we attempted to tie the numbers in the annual reports to the 
numbers in the MISLE database. Despite working extensively with Coast 
Guard personnel to resolve discrepancies, we were unable to fully verify 
the numbers reported in any of these categories. Figure 6 shows, for the 
annual compliance exam, the totals for 2004 and 2005 as stated in the 
annual report and the totals contained in MISLE. For 2004, the total shown 
in the annual report was about 500 more than the total supported in 



38 Pub. L. No. 108-293, 118 Stat. 1028 (2004). 

39 Annual Report on Compliance with Security Standards Established Pursuant to the 
Maritime Transportation Security Plans. Submitted in accordance with Title VIII, Section 
809(i) of the Coast Guard and Maritime Transportation Act of 2004. Throughout this 
section on Coast Guard's Annual Reports, we used the same reporting periods in our 
analysis as was used in Coast Guard's Annual Reports: July 1 - December 31, 2004, January 
1 - November 17, 2005, and January 1 - December 31, 2006, although the 2005 Annual 
Report did not clarify that the enforcement action data included only part of November 
2005. 

40 In October 2007, too late for us to validate as part of this report, Coast Guard officials 
indicated that they discovered an additional 344 annual exams were conducted in 2006 that 
were not in the data provided for our analysis. Officials said they were investigating why 
the additional 344 exams were not previously identified. 



Page 34 



GAO-08-12 Maritime Security 



MISLE, and for 2005, the total shown in the annual report was about 179 
less. 41 



Figure 6: Annual Compliance Exam Numbers in Coast Guard's Annual Report to 
Congress and GAO Analysis of MISLE Data 
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Source: GAO analysis of Coast Guard's annual report to Congress and MISLE data. 

"We estimated the Coast Guard's Annual Report Annual compliance exam figures for 2004 and 2005 
from a monthly bar chart without numbers. The Coast Guard was not able to provide us with precise 
numbers. A Coast Guard official informed us that the bar chart was created using MISLE data as well 
as sector input due to MISLE query limitations in 2004-2005 and sector data entry issues in 2004. 

The Coast Guard did not provide annual compliance exam figures in its 2006 Annual Report to 
Congress. 



For spot checks and enforcement actions, the differences between the annual report and 
MISLE figures were smaller than the differences we found comparing figures for the annual 
compliance exam, but we likewise were unable to determine the reasons for these 
differences. In both categories, the figures in the annual reports were higher than the 
figures in MISLE. 
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Coast Guard officials who worked with us to resolve the discrepancies 
gave several possible reasons for differences: 

• The totals in the annual report included a combination of MISLE data 
and other data reported by officials in field units. 42 

• The annual report inspection data could have included some safety- 
related activities. 

• Some of the information in MISLE may have changed between the time 
the Coast Guard used the database to prepare numbers for the annual 
report and the time the Coast Guard provided the data for us. 

We were not able to determine the extent, if any, to which these factors 
contributed to the discrepancies. The more significant issue, however, is 
not resolving the effect of these three factors, but rather recognizing the 
fundamental limitation reflected in being unable to reconcile differences 
between the numbers in the annual report with the numbers in the 
database. The ability to monitor and oversee a program is limited if 
officials cannot rely on the accuracy of the information they have at hand. 

At some sectors we visited, Coast Guard officials voiced similar concerns 
about having to rely on MISLE data for assessing trends. Inspectors in all 
seven sectors said they use MISLE to track compliance activities at 
individual facilities, but several reported that using MISLE to produce 
accurate aggregated information and trend data for the sector was more 
difficult. Inspectors in four sectors mentioned creating their own 
spreadsheets outside MISLE to more easily produce reports on 
administrative information (such as facility addresses and phone 
numbers), to check for MISLE report errors, and to track additional 
information not requested in MISLE. They indicated a variety of ways in 
which MISLE could be improved for use, including allowing MISLE to 
capture facility-specific security enhancements and weaknesses and 
linking MISLE data with information on security vulnerabilities captured 
by the maritime security risk assessment model. 



Coast Guard officials explained that 2004 and 2005 annual report inspection numbers 
included field unit input because, at the time, MISLE queries were unable to relate an 
inspection type with an inspection date. Field unit input was also included in the 2004 
Annual Report inspection numbers because, during 2004, Annual Compliance Exams were 
sometimes not recorded as inspections, but rather as part of the initial Facility Security 
Plan review. 
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A second concern about the annual report compliance data is its limited 
scope that does not provide a complete picture of Coast Guard compliance 
activities or a relevant context for reviewing them. Annual compliance 
exams were not reported in 2006, and the number of deficiencies 
identified by Coast Guard oversight was not included in either the 2005 or 
2006 report. Further, the total number of inspections that the Coast Guard 
conducted is not provided within the context of the total number of 
facilities regulated, and the number of spot checks is presented without 
the number of facilities that received the checks. As we pointed out earlier 
in this report, some of this information, such as the number of facilities 
subject to MTSA regulation, is not available in MISLE. To the degree that 
relevant information is not available or is difficult to extract, decision 
makers may not be able to see the Coast Guard's activities in full or in 
context. 

The annual report's presentation may also under-represent the Coast 
Guard's actions in ensuring that facilities comply with security plans. The 
annual report presents enforcement actions issued, but does not report 
deficiencies identified. As we discussed earlier in this report, only 16 
percent of deficiencies in 2006 resulted in enforcement actions. Since the 
Coast Guard prefers a strategy of working with facilities to improve 
facility compliance, rather than a punitive strategy, there are many facility 
deficiencies that are identified and corrected without an enforcement 
action, and therefore are not reported in the Annual Report. While 
enforcement actions generally represent the most severe instances of 
noncompliance, the extent of the Coast Guard's activity in identifying 
deficiencies is not presented. 

The Coast Guard Has Taken The Coast Guard has acknowledged improvement is needed in MISLE 
Some Action to Improve MISLE compliance data and has taken initial steps to reduce some of the database 

concerns identified during the course of our review. Coast Guard officials 
at all levels we spoke to said problems introduced during data entry to 
MISLE were a concern. As we were conducting our review, the Coast 
Guard took some steps to improve the data. 

• In July 2007, in a message to all units about implementing the SAFE 
Port Act maritime facility inspection requirements, the Commandant 
mentioned the issue of entering data into MISLE on a timely basis. The 
message states, "To minimize the need for frequent data calls and to 
ensure an accurate picture of Coast Guard facility inspection 
performance, sectors must ensure that MISLE data is entered promptly 
and that the activity, subactivity data, and AOR (area of responsibility) 
are accurate." The message also details that inspection records should 
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indicate whether annual exams or spot checks were performed on an 
announced or unannounced basis. 

• During a 3-day Coast Guard workshop on MTSA and the Transportation 
Worker Identification Card held in November 2007, MISLE data entry 
and performance measures were discussed, according to an after 
action report of the workshop. No action items were detailed that 
related to changes in MTSA compliance data. 

These initial efforts may help to improve MISLE, but they do not address 
all of the concerns we identified. For example, Coast Guard area officials 
stated a need for more consistency in how data are entered across 
violations, noting that inspection dates are fine, but the violations are hard 
to categorize accurately, leading to the question of whether the data 
collected is accurate. The steps announced so far do not involve actions 
for resolving such inconsistencies. Further, as we pointed out, MISLE 
contains duplicate records, and information is not always complete. The 
Coast Guard's initial steps do not include solutions to such problems. 



Since 2004, the Coast Guard has made progress in shifting the inspection 
program from one that emphasized putting security procedures in place to 
one that focuses on continued facility compliance with security 
procedures. Thus far, the Coast Guard's estimates the number of 
inspectors has been and will be sufficient to meet inspection requirements, 
but the multiple roles of many inspectors and the new requirements for 
spot checks at all facilities could affect the reliability of these estimates. 
Coast Guard officials currently cannot document how much of inspectors' 
time is spent on the facility enforcement program versus conducting other 
tasks. New spot check requirements may pose additional workload 
requirements, not only because spot checks must now be conducted of all 
facilities, but also because the Coast Guard's recent guidance calls for 
placing an inspector inside the facility rather than just driving by. Plans 
for adding an additional 25 staff will help meet these needs, but without 
considering all factors, the Coast Guard is at additional risk of inspection 
requirements not being met. 

The Coast Guard gives considerable leeway to sectors and local units in 
deciding how to implement requirements, and as this report has shown, 
units have gone in somewhat different directions. For example, some have 
decided to conduct the annual compliance exam unannounced, while 
others announce them in advance, and some use formal enforcement 
actions such as written warnings or fines while others do not. The 
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inspection program's growing maturity heightens the importance of being 
able to determine what it is accomplishing and to assess alternative 
practices sectors have adopted to ensure facility compliance. Coast Guard 
headquarters, however, has not evaluated these various approaches to 
determine which ones produce greater results or yield greater efficiency. 
Finally, whether establishing that basic inspection requirements are being 
met, comparing the various approaches used in individual sectors, or 
evaluating other aspects of the facility compliance program, the Coast 
Guard is handicapped without complete and accurate compliance data. 
Coast Guard officials acknowledge these data problems, and initiated 
some improvements; however, efforts have not yet remedied all problems 
that have been identified. 



To help ensure that MTSA facility-related inspection requirements are 
being implemented effectively, we recommend that the Secretary of 
Homeland Security direct the Commandant of the Coast Guard to take the 
following three actions: 

• Reassess the adequacy of resources for facility inspections, given 
changing inspection guidance and the multiple duties of sector 
personnel. 

• Assess the effectiveness of differences in program implementation by 
sector to identify best practices, including the use of unannounced 
annual compliance exams and the varying use of enforcement actions. 

• Assess MISLE compliance data, including the completeness of the data, 
data entry, consistency, and data field problems, and make any changes 
needed to more effectively utilize MISLE data. 



We requested comments on a draft of this report from the Secretary of 
DHS and from the Coast Guard. The Department declined to provide 
official written comments to include in our report. However, in an e-mail 
received January 23, 2008, the DHS liaison stated that DHS concurred with 
our recommendations. Written technical comments were provided by the 
Coast Guard that were incorporated into the report as appropriate. 



As we agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution of it until 30 days 
from the date of this letter. We will then send copies to others who are 
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interested and make copies available to others who request them. In 
addition, the report will be available at no charge on GAO's website at 
http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 
me at (202) 512-9610 or at caldwells@gao.gov. Contact points for our 
Office of Congressional Relations and Public Affairs may be found on the 
last page of this report. Key contributors to this report are listed in 
appendix III. 




Stephen L. Caldwell 

Director, Homeland Security and Justice Issues 
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Appendix I: Objective, Scope, and 
Methodology 



This report addresses the Coast Guard's implementation of the Maritime 
Transportation Security Act of 2002 (MTSA) facility security requirements, 
as amended by, among other things, the Security and Accountability For 
Every Port Act (SAFE Port Act). Specifically, our objectives included 
determining the extent to which the Coast Guard: 

• has met its maritime facility inspection requirements under MTSA and 
the SAFE Port Act and has found facilities to be in compliance with 
their security plans, 

• has determined the availability of trained personnel to meet current 
and future facility inspection requirements, and 

• has assessed the effectiveness of its MTSA facility oversight program 
and ensured that program compliance data collected and reported are 
reliable. 

To determine whether the Coast Guard has met its inspection 
requirements and has found facilities to be in compliance with their 
security plans, we analyzed 2004-2006 compliance activity data from the 
Coast Guard's Marine Information for Safety and Law Enforcement 
(MISLE) database. Over a period of 5 months, we requested and obtained 
data from MISLE to document Coast Guard compliance and enforcement 
activities related to MTSA facilities from July 1, 2004, the deadline for 
facilities to be operating under a Coast Guard-approved facility security 
plan, to December 31, 2006. The Coast Guard extracted three types of data 
and provided them as data spreadsheets, including: 

• Inspections: Annual Compliance Exams, Security Spot Checks, and 
Facility Exercise Monitoring at specific MTSA facilities. 

• Deficiencies: the number and nature of deficiencies recorded during 
the inspections. 

• Enforcement Actions: sanctions and remedial actions directed by the 
Coast Guard for incurring deficiencies. 

To assess the reliability of MISLE data, we (1) performed electronic testing 
for obvious errors in accuracy and completeness; (2) reviewed related 
documentation, such as MISLE user guides; and (3) held extensive 
meetings and exchanged correspondence with Coast Guard information 
systems officials to discuss data entry and analysis and ensure correct 
identification of specific data fields regarding the data. When we found 
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Appendix I: Objective, Scope, and 
Methodology 



discrepancies, we brought these to the Coast Guard's attention and 
worked with agency officials to correct them to the extent possible before 
conducting our analyses. Given the discrepancies we identified, we took 
several steps prior to our analysis to improve the accuracy and usefulness 
of the data the Coast Guard supplied. These included: 

• Removing 77 records from facility deficiencies that were "opened in 
error," which Coast Guard indicated generally were duplicate records. 

• Creating a dataset linking deficiencies and enforcement actions. We 
performed several checks on the merged file and worked with the 
Coast Guard to reduce data inconsistencies. 

• Creating a new "Sector" field based on Coast Guard documentation and 
interviews on the new sector breakdowns, and for 2006 consolidated 
the existing "Unit" field into the appropriate sector. 

Coast Guard data analysts acknowledged that there are duplicate 
deficiencies and enforcement actions in MISLE and that MISLE has no 
automated process to accurately determine which duplicate activity to 
remove — the process would involve looking at individual narratives to 
attempt to determine which activity was a duplicate. We used the 
following approach to identify duplicates: when we identified activities 
that had the same deficiency identification number and citation, we 
checked 21 other data fields in MISLE for duplication. If two or more 
observations had the same values in all of these fields, we retained one 
observation, designating the others as duplicates. Using this process, we 
classified 32 of 7,620 total observations, or less than 1 percent of 
deficiencies in each year, as duplicative. We chose to keep the 
observations in the analyses because it was not clear which activity to 
delete because we lacked a more reliable means for identifying duplicates 
that were not identical for all fields examined, and because of the small 
number of observations our approach identified. 

After conducting the above steps, we determined that the data were 
sufficiently reliable to provide a general indication of the magnitude and 
relative frequencies of compliance activities. The corrected data sets were 
used to analyze national and sector-based Coast Guard MTSA compliance 
activities, including inspections, deficiencies, and enforcement actions. 
Our report discusses MISLE data problems in more detail, along with the 
steps we believe are needed to address them. 
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To supplement our analysis of MISLE data in understanding the Coast 
Guard's progress on inspection requirements, we selected 7 of the Coast 
Guard's 35 sectors for more detailed review. We selected sectors that 
would provide a range of Coast Guard environments in which MTSA is 
being implemented, and to ensure a broad representation of types of ports, 
we chose sectors with ports that varied in size, varied in types of waterway 
(ocean, river, and lake), and geographic diversity. While results from these 
seven sectors cannot be generalized to all Coast Guard sectors, we 
determined that the selection of these sites was appropriate for our design 
and objectives and that the selection would provide valid and reliable 
evidence. In each sector, we interviewed Coast Guard inspectors 
responsible for oversight of MTSA facility plans, facility security officers at 
MTSA facilities (28 facilities overall), and other port stakeholders in each 
port, such as port authority personnel and facilities adjacent to MTSA 
facilities. Sectors we visited included Hampton Roads, Virginia; Honolulu, 
Hawaii; Lake Michigan, Michigan; Los Angeles/Long Beach, California; 
New York/New Jersey; Seattle, Washington; and Upper Mississippi River, 
Missouri. We conducted our visits — as well as some follow-up discussions 
by phone — from December 2006 through August 2007. 

We also met with the Coast Guard Atlantic and Pacific area officials to 
discuss compliance activities, and with headquarters program and 
information system officials multiple times to discuss our analysis. We 
reviewed relevant sections of the Maritime Transportation Security Act, 
the SAFE Port Act, Coast Guard implementing regulations, Navigation and 
Vessel Inspection circulars, prior GAO reports, and MISLE documentation. 

To establish whether the Coast Guard has determined the availability of 
trained personnel to meet current and future facility inspection 
requirements, we summarized data provided by the Coast Guard from its 
Direct Access database on the number of personnel trained to conduct 
MTSA inspections. Direct Access is the Coast Guard's Human Resource 
system, used for a variety of personnel functions. The Coast Guard 
provided a spreadsheet of personnel certified with one or more Maritime 
Security Qualifications from this database. To assess the reliability of the 
spreadsheet data, we looked for obvious errors and inconsistencies in the 
data, and requested information from Coast Guard officials to understand 
limitations in the data and make corrections where possible. We identified 
limitations in the data related to duplicate entries and certifications not yet 
entered into the system. Duplicate entries result, for example, because 
staff may be listed twice if they are employed as both a reservist and 
civilian Coast Guard employee, or may be listed under a sector and under 
a pre-sector unit. We deleted duplicate entries identified by Coast Guard to 
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arrive at the number of trained personnel, but we were unable to 
determine how many certifications had not yet been entered in the system. 
Given this limitation, we found the Direct Access data to be sufficiently 
reliable to provide only an approximate number of personnel qualified to 
conduct MTSA facility inspections. 

The Coast Guard provided verbal information on the number of personnel 
currently in facility inspection positions. We conducted several interviews 
with relevant Coast Guard headquarters managers regarding the number 
of inspectors that have been trained, the allocation of staff to inspection 
positions, the training provided to current inspectors, and plans for future 
training and resources for conducting facility inspections. We also 
discussed current and planned guidance for conducting facility 
inspections with headquarters officials. In the seven sectors we visited, we 
met with facility inspectors to discuss facility inspector training, the 
adequacy of inspection resources, guidance used to conduct inspections, 
and other inspector responsibilities. We discussed the consistency of 
inspections with facility security officers in facilities located in the seven 
sectors. We also reviewed written Coast Guard guidance related to MTSA 
facility inspections, such as relevant circulars, memos, and on-line 
resources, and documents on planned revisions to facility oversight 
regulations. 

To determine the extent to which the Coast Guard has assessed its MTSA 
facility oversight program and ensured that program compliance data is 
accurate, we requested the Coast Guard provide documentation of any 
evaluation of activities related to facility oversight and reviewed the two 
annual reports that the Coast Guard provided. We reviewed Office of 
Management and Budget documents and prior GAO reports on assessing 
program effectiveness. Our assessment of the accuracy of the Coast Guard 
compliance data was based on our reliability assessment of MISLE data 
we conducted as part of objective 1. We also discussed the accuracy and 
utility of MISLE data with facility inspectors during our site visits to seven 
sectors. 

We conducted this performance audit from May 2006 through February 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit to 
obtain sufficient, appropriate evidence to provide a reasonable basis for 
our findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our findings 
and conclusions based on our audit objectives. 
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This appendix summarizes GAO's analysis of deficiencies identified by 
Coast Guard facility inspectors nationwide from 2004-2006 based on the 
MTSA regulatory citation associated with each deficiency. Facility security 
plans are written to meet requirements established by MTSA regulations, 
and the deficiency documentation in the Coast Guard's compliance data 
includes the citation for the associated MTSA regulation. 

Under a specific citation, in most cases there are a number of sub- 
elements. We summarized the deficiency data at the general citation level 
because the data collected on facility compliance did not consistently 
identify deficiencies at a more detailed level. 1 



The data in table 5 is presented based on the frequency the of the 
deficiency citation for 2006. 



Table 5: Total Nationwide Facility Deficiencies for 2004-2006 by MTSA Regulation Citation 






Number of facility deficiencies for 
each MTSA regulation citation 




MTSA regulation citation 


Citation description 


2004 a 


2005 


2006 


33CFR1 05.255 

Security measures for 
access control 


Requires security measures to deter the introduction of 
unauthorized dangerous substances and devices, to 
check the identity of persons seeking entry, and to 
identify restricted areas, among other requirements. 


696 


445 


458 


33CFR1 05.225 

Facility recordkeeping 
requirements 


Requires facility records be kept for 2 years on measures 
such as security training, security equipment calibration, 
drills and exercises, and security breaches. 


248 


336 


418 


33CFR1 05.260 

Security measures for 
restricted areas 


Requires measures for protection of restricted areas, 
such as shore areas, areas with sensitive security 
information, and areas with dangerous cargo. 


545 


344 


364 


33CFR1 05.220 

Drill and exercise 
requirements 


Requires quarterly drills and annual exercises to test 
personnel performance of security duties and effective 
implementation of the facility security plan, for example, 
a drill of personnel responses to a security alarm, or an 
exercise of security plan communication procedures. 


56 


180 


269 



1 For example, under 33 C.F.R. 105.2 10 Facility personnel responsible for security duties, 
there are 13 specific areas that personnel are required to have knowledge, such as the 
ability to recognize and detect dangerous substances and crowd management and control 
techniques. However, a number of the narrative descriptions for this deficiency indicated a 
general need for security personnel training, rather than specific training needs. 
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Number of facility deficiencies for 
each MTSA regulation citation 




MTSA regulation citation 


Citation description 


2004 a 


2005 


2006 


33CFR105.415 

Facility Security Plan 
amendment and audit 


Facility security plan amendments, such as a change in a 
security procedure, must be approved by the Coast 
Guard following certain procedures, and an annual audit 
of the plan must be conducted. 


37 


190 


243 


33CFR1 05.205 
Facility Security Officer 


Establishes facility security officer qualifications, such as 
knowledge of vessel and facility operations, and other 
responsibilities, such as ensuring adequate training of 

co^iiri+v/ norcnnnol anrl that tho nlan ic DVDrpicDrl amnnn 
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other things. 


167 


114 


152 


33CFR1 05.200 
Owner or operator 


Requires owner or operator to comply with facility 
security requirements such as to identify a facility 
security officer, and ensure coordination of shore leave 
for vessel personnel, among other things. 


76 


86 


108 


33CFR105.210 

Facility personnel with 
security duties 


Requires security personnel to have knowledge in 
security-related areas, such as techniques used to 
circumvent security procedures, emergency procedures, 
and relevant security plan provisions, among other 
things. 


144 


97 


80 


33CFR1 05.250 

Security systems and 
equipment maintenance 


Requires security systems and equipment to be in good 
working order, and be properly tested and maintained, 
among other things. 


63 


68 


53 


33CFR1 05.405 

Format and general 
content of the Facility 
Security Plan 


Establishes a required structure and content for the 
facility plan, such as the order for sections, among other 
things. 


49 


34 


53 


33CFR105.215 

OcoUilly LidlMlliy Iwi cm 

other facility personnel 


Requires certain knowledge for non-security personnel, 
for example, the meaning of varying maritime security 
levels that apply to them, and emergency procedures." 


94 


80 


48 


33CFR1 05.245 

niopla ratinn ctf Qofiiritw 
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Requires the facility owner or operator, among other 
things, to document security procedures for coordinating 
security with vessels, such as the transfer of cargo or 
passengers. 


37 


34 


34 


33CFR1 05.270 

Security measures for 
delivery of vessel stores 
and bunkers 


Requires that security measures are in place for the 
delivery of vessel stores and bunkers, such as requiring 
material be inspected before it is accepted. 


42 


17 


33 


33CFR1 05.275 

Security measures for 
monitoring 


Requires security measures be in place that allow 
continuous monitoring, for example of the facility and 
approaches to it, and monitoring vessels using the 
facility. 


89 


44 


29 


33CFR105.145 

Maritime Security 
Directive 


Requires that facility owner or operator must comply with 
instructions contained in an applicable maritime security 
directive issued by the Coast Guard. 


42 


26 


25 
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Number of facility deficiencies for 
each MTSA regulation citation 



MTSA regulation citation 


Citation description 


2004 a 


2005 


2006 


33CFR1 05.235 
Communications 


A facility security officer must have the means to 
effectively notify facility personnel and others, such as 
the police, of changes in security conditions, and 
effectively communicate with others, such as the police, 
and meet certain requirements, such as having a backup 
for internal and external communications. 


31 


35 


23 


33CFR1 05.400 

Facility Security Plan, 
General 


Requires a facility plan be developed and implemented 
by the facility security officer, and related requirements, 
such as the procedures for preventing unauthorized 
electronic amendment, among other things. 


17 


30 


21 


33CFR105.125 
Noncompliance 


Requires that the Coast Guard be notified if the facility 
deviates from procedures outlined in their approved 
security plan, and that the facility stop operations or 
obtain approval to continue operating. 


29 


15 


18 


33CFR105.120 

Compliance 
documentation 


After July 1 , 2004, documentation of the Coast Guard- 
approved facility plan or alternative security plan must be 
available to the Coast Guard on request. 


15 


20 


18 


33CFR1 05.280 

Security incident 
procedures 


The owner or operator must ensure that the facility 
security officer and security personnel are able to 
respond to security breaches, and evacuate the facility, 
among other things. 


26 


10 


17 


33CFR1 05.265 

Security measures for 
handling cargo 


Requires that security measures relating to cargo 
handling are implemented, for example to deter 
tampering, and to ensure cargo is released only to the 
correct carrier. 


67 


15 


13 


33CFR1 05.295 

Additional requirements — 
Certain Dangerous Cargo 
facilities 


Additional requirements for facilities handling certain 
dangerous cargo include, for example, all security 
personnel must record or report their presence at key 
patrol points, and parking and unloading of vehicles is 
controlled. 


27 


7 


7 


33CFR105.140 

Alternative Security 
Program 


Sets the criteria for operating under an approved 
alternative security plan, for example, if it is appropriate 
to the facility and is adopted in its entirety. 


2 


1 


6 


33CFR1 05.230 

Maritime Security Level 
coordination and 
implementation 


Requires that a facility operate consistent with the 
security level established for the port overall, sets time 
frames for having higher security level measures in 
place, and identifies possible additional security 
measures at higher security levels. 


28 


8 


5 
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Number of facility deficiencies for 
each MTSA regulation citation 



MTSA regulation citation 


Citation description 


2004 s 


2005 


2006 


33CFR105.410 

Facility Security Plan 
submission and approval 


Required that facility security plans be submitted by 
December 31 , 2003, or within 60 days before beginning 
operations, if operations start after the initial deadline, 
and outlines the steps for review and approval of the 
plan. 


12 


4 


3 


33CFR1 05.305 

Facility Security 
Assessment requirements 


Establishes information and analysis requirements for 
facility security assessments, such as requiring an "on- 
scene" survey of the facility, requiring key security 
information be included such as the location of 
evacuation routes, and that vulnerabilities be identified, 
among other things. 


9 





3 


33CFR105.310 

Facility Security 
Assessment submission 
requirements 


Requires that the security assessment be submitted with 
the facility security plan, allows one assessment be 

OUDI MILLcU 1UI [ItUILipiC 1 aKji 1 1 UCO, CU IU LI Ic aaocool 1 lcl 1 1 MIUoL 

be approved by the Coast Guard and updated with 
security plan reapprovals or revisions. 


6 





2 


oor;FRi ins 
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Applicability 
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regulations, for example, foreign cargo vessels over a 
certain weight. 


2 


4 


2 


Q'JOFRI OR 9Qf) 

Additional requirements — 
cruise ship terminals 
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screening all persons, baggage and personal effects for 
dangerous substances or devices. 


2 


12 


2 


33CFR1 05.300 

Facility Security 
Assessment, General 


Establishes the assessment as a written document, that 
an assessment can cover multiple facilities, and that third 
parties with expertise in areas such as contingency 
planning can be involved in the assessment. 








2 


33CFR1 05.240 

Procedures for interfacing 
with vessels 


Requires facility owner or operator to ensure that there 
are measures for interfacing with vessels at all security 

|gYg|5_ 


4 


4 


1 


33CFR105.100 
Definitions 


Establishes that the definitions in the general maritime 
security section apply to the maritime facility section as 
well. 








1 

see Note 


33CFR105.110 
Exemptions 


Establishes the exemption criteria from maritime facility 
requirements, for example, some shipyard facilities are 
exempt. 





2 


1 


33CFR1 05.296 

Additional requirements — 
barge fleeting facilities 


Barge fleeting facilities are also required to designate 
restricted areas to handle certain dangerous cargoes, 
and ensure that a certain number of towing vessels are 
available for a given number of barges, among other 
things. 





1 


1 


33CFR1 05.285 

Additional requirements — 
passenger and ferry 
facilities 


Passenger and ferry facilities are also required to 
segregate unchecked persons and personal effects from 
checked persons, and screen unaccompanied vehicles 
before loading, among other things. 


8 


1 
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Number of facility deficiencies for 
each MTSA regulation citation 


MTSA regulation citation 


Citation description 


2004 a 


2005 2006 


33CFR105.135 
Equivalents 


Allows facility owner or operator to propose an equivalent 
security measure if it is equal or exceeds the 
effectiveness of the required measures. 


4 





33CFR105.106 
Public access areas 


Allows the designation of a public access area within a 
MTSA facility serving passenger vessels of a certain 
size, other than cruise ships. 





1 


Total 




2,674 


2,265 2,513 



Source: GAO analysis of Coast Guard compliance data. 



Note: Our work identified reliability issues with Coast Guard's data, such as a lack of consistency and 
missing information. Given these concerns, these figures are presented to provide an indication of the 
relative frequency that different deficiencies were identified, and not as a precise measure. As one 
example, the single deficiency identified under 33 C.F.R. 105.100 Definitions, was miscoded, based 
on the narrative for the deficiency, which indicated the "facility failed to implement proper security 
measures for monitoring by neglecting to have facility personnel on site at all times while a vessel 
was moored at the facility." 

"Facilities were not required to have a facility security plan in place until July 1 , 2004, therefore, the 
reporting period is from July 1 , 2004, to December 31 , 2004. 

"Maritime security levels are set by the Commandant of the Coast Guard to reflect level of risk to the 
maritime transportation system, a higher level reflecting greater risk. Facility security plans 
incorporate security measures to be taken at varying maritime security levels. 
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